Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

CVEs (684)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-20007 1Rest/json Project 1Rest/json Nov 21, 2024 Jan 1, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVE-2020-29667 1Lanatmservice 1M3 Atm Monitoring System Jun 17, 2026 Dec 10, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system because of Insufficient Session Expiration.
CVE-2020-4696 1Ibm 1Cloud Pak For Security Jun 17, 2026 Nov 30, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitive information from the previous session. IBM X-Force ID: 186789.
CVE-2020-13353 1Gitlab 1Gitaly Jun 17, 2026 Nov 17, 2020 N/A· v4 3.2 LOW· v3 2.1 LOW· v2 When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
CVE-2020-27422 1Anuko 1Time Tracker Jun 17, 2026 Nov 16, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
CVE-2020-23140 1Microweber 1Microweber Jun 17, 2026 Nov 9, 2020 N/A· v4 8.1 HIGH· v3 5.8 MEDIUM· v2 Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and rema...Show more Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active.Show less
CVE-2020-23136 1Microweber 1Microweber Jul 9, 2026 Nov 9, 2020 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Microweber v1.1.18 is affected by no session expiry after log-out.
CVE-2020-15950 1Immuta 1Immuta Jun 17, 2026 Nov 5, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout.
CVE-2020-25374 1Cyberark 1Privileged Session Manager Jun 17, 2026 Oct 28, 2020 N/A· v4 2.6 LOW· v3 2.1 LOW· v2 CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.
CVE-2020-24713 1Getgophish 1Gophish Jun 17, 2026 Oct 28, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
CVE-2020-27739 1Citadel 1Webcit Jun 17, 2026 Oct 28, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Mu...Show more A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.Show less
CVE-2020-15269 1Sparksolutions 1Spree Jun 17, 2026 Oct 20, 2020 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is des...Show more In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.Show less
CVE-2020-1666 1Juniper 1Junos Os Evolved Jun 17, 2026 Oct 16, 2020 N/A· v4 6.6 MEDIUM· v3 7.2 HIGH· v2 The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker wi...Show more The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker with physical access to the console the ability to resume a previous interactive session and possibly gain administrative privileges. This issue affects all Juniper Networks Junos OS Evolved versions after 18.4R1-EVO, prior to 20.2R1-EVO.Show less
CVE-2020-6363 1Sap 1Commerce Cloud Jun 17, 2026 Oct 15, 2020 N/A· v4 4.6 MEDIUM· v3 4.9 MEDIUM· v2 SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credent...Show more SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate active sessions that the user may have with SAP Commerce Cloud web applications, which gives an attacker the opportunity to reuse old session credentials, resulting in Insufficient Session Expiration.Show less
CVE-2020-4395 1Ibm 1Security Access Manager Appliance Jun 17, 2026 Oct 14, 2020 N/A· v4 5.4 MEDIUM· v3 5.5 MEDIUM· v2 IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 179358.
CVE-2020-4780 1Ibm 1Curam Social Program Management Jun 17, 2026 Oct 12, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observe...Show more OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158.Show less
CVE-2019-19199 1Reddoxx 1Maildepot Jun 17, 2026 Oct 2, 2020 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout.
CVE-2020-15774 1Gradle 1Enterprise Jun 17, 2026 Sep 18, 2020 N/A· v4 6.8 MEDIUM· v3 4.6 MEDIUM· v2 An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their...Show more An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user.Show less
CVE-2020-13307 1Gitlab 1Gitlab Jun 17, 2026 Sep 15, 2020 N/A· v4 4.7 MEDIUM· v3 6.0 MEDIUM· v2 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their ac...Show more A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access.Show less
CVE-2020-13305 1Gitlab 1Gitlab Jun 17, 2026 Sep 14, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project.

Previous 1...293031...35 Next